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^^Executive Summary and Conclusions 



The task of the Borssele Benchmark Committee 
is to determine whether the Elektriciteits 
Produktiemaatschappij Zuid-Nederland (EPZ) 
ensures that its 

"Borssele nuclear power plant (Kerncentrale 
Borssele- KCB) continues to be among the 
twenty-five percent safest water-cooled 
and water-moderated power reactors in the 
European Union, the United States of America 
and Canada. Asfar as possible, safety shall 
be assessed on the basis of quantified 
performance indicators. If quantitative 
comparison is not possible for the design, 
operation, maintenance, ageing and safety 
management, the comparison shall be made 
on the basis ofa qualitative assessment by 
the Committee." 



This condition is part of an agreement not to 
close down the plant in 2013 - as was politically 
intended - but to allow it, in principle, to 
continue operation until 31 December 2033. 
This agreement was formalised in a covenant, 
which also included the installation of the 
Borssele Benchmark Committee to evaluate if 
KCB meets this condition. The Committee had to 
report the results of its first evaluation in 2013. 

To establish an expert opinion on the safety 
level of the KCB, as compared with the 
approximate 250 water-cooled and water- 
moderated reactors in the EU, US and Canada, 
the Committee had to develop its own 
methodology. There are no internationally 
harmonised evaluations available for all 
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safety aspects of a nuclear plant on the basis 
of which the safety can be expressed in one 
welL-defined number. Requirements for nuclear 
safety are basically the responsibility of 
national regulatory authorities, which implies 
that the importance attached to various safety 
aspects is not necessarily uniform. The efforts 
of organisations, Li ke IAEA (International 
Atomic Energy Agency), to harmonize these 
requirements withstanding national differences 
remain. Furthermore, opinions about what is 
important for nuclear safety evolve over time 
as a result of operating experience including 
root cause analyses of incidents. The speed 
and possibilities to adapt plants to new 
requirements differ. Lastly, it is debatable if 
the safety of a plant can be expressed in one 
well-defined number. Work is going on to 
combine all relevant safety aspects of design 
and operations in one model. Advanced 
Probabilistic Safety Analysis (PSA) would make 
this, in principle, possible. However, to use 
such a model for benchmarking the safety of 



the KCB, it would have to be implemented in a 
highly standardised way. Even when this would 
theoretically be possible, it would require 
an enormous effort, and be hindered by the 
unavailability of standardised plant specific 
information and data. 

Ranking plant safety is subsequently a 
complicated, if not impossible, task with a 
time dependant outcome. Nevertheless, the 
Committee is convinced that it developed 
a meaningful methodology on the basis of 
all available information that could be used 
to compare the safety of the 250 plants the 
Committee had to assess. Schematically the 
Committee opted for the approach as shown in 
the figure on page 6. This methodology contains 
a separate safety assessment of: 

► Reactor design 

► Reactor operations (covering operation, 
maintenance, safety management and 
ageing). 



Using the developed methodology the committee compared the safety of the approximate 250 
plants. From this assessment the committee unanimously concluded that both in design and 
operations the KCB is well within the top 25% safest water-cooled and water-moderated reactors 
in the EU, US and Canada. 



So the plant meets, at this moment, the condition in the covenant regarding its safety to continue 
operation. 




To properly explain the background of this conclusion this summary contains a fairly complete overview 
of the report. 



5 



The Safety of BorsseLe, Nuclear Power Station | First report of the Borssele Benchmark Committee 



Schematic approachfor the benchmark 
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Design safety 

For nuclear plant safety it is essential to assure 
under all circumstances: 

1) Reactivity control 

2) Heat removal 

3) Confïnement of radioactivity 

The Committee discussed the contribution of 
design to achieve these goals, in particular 
regarding the plants capabilities for accident 
prevention, accident mitigation and containing 
radioactive substances within the plants' 
interior to reduce hazards for the environment. 
It decided that from this perspective the most 
relevant design features are: 
t Redundancy and diversity of safety systems 

> Design of containment 

> Availability of bunkered systems 
I Severe accident management 

For each of these design features, design 
solutions were identified and scoring criteria 
attributed depending on their impact on safety 
for each type of plant. 

Considering the complexity of the evaluation 
method, the scoring scheme was tested 
which lead to some improvements in the 
benchmarking method. In the end it gave the 
Committee the comfort that the methodology it 
developed was appropriate for the evaluation 
of the safety of design. All the approximate 250 
plants in the benchmark were evaluated with 
this methodology using the large amount of 
available data on the design of each of those 
plants. This required a considerable effort. The 
outcome was subsequently used to identify 
the 25% safest plants from the design point of 
view. 



From the results the Committee concluded that: 

► The plants considered have scores in 
the entire range possible, with a denser 
population in the middle of the scale and 
scarcer towards both ends 

► Both Pressurised Water Reactors and Boiling 
Water Reactors rank in the top 25% and 
below 

► Both older and newer plants have high 
scores as well as low ones 

► The results do not depend exclusively on 
one of the design features, nor are they 
insensitive to any of them 

The scoring scheme utilised in this design 
benchmark places all the four features of 
design safety at the same level of importance. 
To analyze the sensitivity of the results for 
this assumption the Committee performed 
a sensitivity analysis changingthe relative 
importance of the four features. In this analysis 
the importance of each of the design features 
was in turn reduced to half or doubled, while 
maintaining the same score for the other three. 

This sensitivity analysis showed that: 
k The group of plants in the top 25% did not 
change in any of the studied cases 

► A few plants change their position within 
the top 25% but none are leaving the top 

Conclusion for design 

After carefully studying the results the 
Committee is convinced that it has developed a 
relevant way of ranking the safety of design for 
the purpose of this benchmark. 
Using this method the Committee concluded 
that in design the KCB is well within the top 
25% safest water-cooled and water-moderated 
reactors in the EU, US and Canada. 
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In the opinion of the Committee the KCB's 
favorable score in the design review is the 
result of prudent original design, but even more 
of continuous safety improvement programs 
which have taken place since 1986 as a result of 
periodic safety reviews. 

Safety in operations 

For evaluating the safety of the way plants 
are operated the Committee opted for a two- 
step approach. In the first step it decided to 
select the top 25% of best performing plants 
on the basis of performance indicators. These 
indicators reflect performance in the past but 
do not assure the same performance in the 
future. To cover this, the Committee concluded 
that it is equally important to assess, in the 
second step, whether safety performance is 
the result of well-defined and well-managed 
processes directed by the plant's management. 
Considering the amount of information needed 
for a detailed process analysis it is only feasible 
for a sample of the plants concerned. However, 
to determine whether KCB's performance in the 
management of operations is similar to that of 
the 25% of best performing plants in operations, 
it is sufficiënt to compare KCB in a detailed 
analysis with a properly selected sample. 

The first step: selecting the 25% best 
performing plants in operations 

To improve the quality of performance, the 
nuclear industry has instituted an internal 
reporting system to monitor operations on the 
basis of a number of performance indicators 
of which most are also relevant for evaluating 
safety. The reliability of the reporting is 
regularly checked in peer reviews. 



On a confidential basis the Committee had 
access to these performance indicators 
and used them in its first step to select the 
25% nuclear power plants with the best 
safety performance in plant operations of 
the approximate 250 nuclear power plants 
the Committee had to consider. To do so the 
performance indicators had to be combined into 
a composite number using weighting factors 
expressing their relevance for plant safety. 

The first time the Committee did an evaluation 
of the safety performance of plant management 
was in 2008. Given the fact that scores in such 
type of monitoring systems can be substantially 
affected by one-off items the Committee 
decided to use multi-year averages. 

Following the initial evaluation in 2008 it was 
also decided to look for trends in the outcome 
of the ranking by annually repeating these 
evaluations. From this trend analysis, it could 
be concluded that the top 25% on operational 
safety is a fairly stable population. 

In all evaluations KCB was well within the top 
part of the 25% plants that had the best scores 
on the basis of these indicators. 

The second step: evaluation of the plant 
internal processes 

To evaluate if safety performance is the result 
of well-defined and well-managed processes 
directed by the plant's management, requires 
a lot of information about the way plants 
are operated. The Committee concluded 
that for operations, maintenance and safety 
management the reports from the Operational 
Safety Review Team (05ART) programme of 
IAEA would be the only appropriate available 
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source of information for such an analysis. 
Ageing management is not addressed in the 
OSART reviews and an equivalent source of 
information is Lacking. Considering also the 
fact that for a meaningful evaluation of KCB's 
performance in this area a different peer group 
would be needed the Committee decided to 
do process evaluation of ageing management 
separately. 

For the process evaluation of operations, main- 
tenance and safety management, a peer group 
of 10 plants was selected for which sufficiently 
recent OSART reports were available. The 
Committee developed a scoring system to 
combine the outcome of the very extensive 
OSART missions in a composite number 
indicating to what extent safety performance is 
the result of well-controlled processes. 

The results show that the score of KCB is in 
the middle of the range (fifth position) of 
the scores obtained by the peer group. The 
sensitivity analysis indicates that this outcome 
is not affected by the choice of the evaluation 
methodology, or by specific "weighting" 
elements. Even though the input data contain a 
number of uncertainties related to the moment 
in time when the OSART mission was conducted, 
as well as to the uniformity and subjectivism 
of the evaluation, the approach taken assures 
that the results are robust. The middle score 
obtained by KCB supports the conclusion that 
the safety performance in plant operations, 
maintenance, and safety management of the 
KCB compares well to that of the 25% best 
performing plant in operations. 

For the analysis of ageing management the 
Committee had to do its own reviews using 



Ageing Management Criteria based on IAEA 
guidelines. It decided to do so by comparing 
ageing management of KCB with that of a 
peer group of five plants from the 25% best 
performing plant in operations having an age 
relevant for the Borssele benchmark. 

The ageing reviews was based on data supplied 
by the plants about: 

► The plants policy, organisation, and 
methodology for ageing management 

► lts ageing management programmes for 
specific components 

I The plants activities for long-term operation 

Following the reviews, the outcome for KCB 
regarding ageing management was compared 
with that of each of the other plants. 

The evaluation lead to the conclusion that the 
main difference between KCB and the plants 
reviewed is KCB's lacking the implementation 
and documentation of a proper overall ageing 
management strategy, ageing management 
organisational arrangements, and methodology. 
KCB indicated that this will be solved at the end 
of 2013. If this is the case and assuming that 
it will fulfil the Ageing Management Criteria 
(based on IAEA guidelines), ageing management 
of KCB and of the other five plants can be 
considered comparable. 

Conclusion for operations 

The results from both the first and second step 
evaluation of the safety in operations indicate 
that overall the KCB is well within the group 
of 25 % best performing plants. However, its 
ageing management governance should be 
improved. According to KCB the implementa- 
tion and documentation of proper ageing 
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management governance will be completed at 
the end of 2013, which is aLso a requirement of 
the regulator. 



The overall conclusion of the site visits was that 
the impressions of the Committee were in line 
with the expectations from the desktop reviews. 



Site visits 

To complement its analyses the Committee 
visited a number of plants. Mainly to check 
whether the conclusions reached during 
the desktop reviews were supported by the 
impression on-site. In particular, whether the 
strengths and weaknesses, as compared with 
Borssele, that were identified in the review 
process are in line with the impressions 
obtained during the plant visit. Furthermore, 
to understand how specific operational safety 
aspects are managed at each of the visited 
plants compared with the way they are 
managed at KCB. 

In total five plants from the top 25% in design 
and operations were visited apart from KCB. In 
selecting these plants attention was given to a 
proper geographical spread. 

The site visits confirmed that, although there 
are differences in the way plants are managed, 
the operational performance of these plants 
is definitely the result of strictly specified and 
controlled processes. 

A lot of attention in all plants visited is given 
to further improving safety performance. On 
the one hand by improving safety awareness 
and safety culture and on the other hand by 
incorporating the insights of probabilistic safety 
analyses in the management of the plants. The 
Committee noted that KCB is quite active in 
both. 
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BBC 


Borssele Benchmark Committee 
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Safety Aspects of Long Term Operation (IAEA) 


SAM 


Severe Accident Management 


SAMG 


Severe Accident Management Guidelines 
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Fast reactor shutdown 


SSC 
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TMI 
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Western European Nuclear Regulators Association 



The Safety of BorsseLe, Nuclear Power Station | First report of the Borssele Benchmark Committee 



7 



Introduction 



In June 2006 the Dutch Government and the 
owner of the Borssele nuclear power plant 
(N.V. ELektriciteits Produktiemaatschappij 
Zuid-Nederland - EPZ) and its shareholders 
(N.V. Essent and N.V. Delta) agreed to terminate 
the operating life of Borssele nuclear power 
plant no later than 31 December 2033 under 
a number of conditions. This agreement was 
formalised in the "Covenant Kerncentrale 
Borssele" 1 . 

One of the conditions in the covenant 

(see art. 4) is that: 

"EPZshall ensure that Borssele nuclear power 
plant (Kerncentrale Borssele- KCB) continues 
to be among the twenty-five percent safest 
water-cooled and water-moderated power 
reactors in the European Union 2 , the United 
States of America and Canada. Asfar as 
possible, safety shall be assessed on the 
basis of quantified performance indicators. 
If quantitative comparison is not possible for 
the design, operation, maintenance, ageing 
and safety management, the comparison 
shall be made on the basis ofa qualitative 
assessment..." 

This condition is usually referred to as the 
"safety benchmark condition". 

According to the Covenant, a Committee of 
five independent experts, established by 
the covenant parties, shall assess whether or 
not this condition is met. The opinion of the 
Committee shall be reported to the covenant 



parties every five years, starting in 2013 and 
will be made public. 

The Committee was established in 2008 with 
the following composition: 

► W.K. Wiechers, former CEO of Essent 
(chairman), The Netherlands 

I 3. Pachner, principal advisor of Pachner 
Associates, Ottawa, Canada 

► R. Stück, head Reactor Safety Analysis 
Division, Cesellschaft für Anlagen- und 
Reaktorsicherheit (GRS), Köln, Germany 

I B. Tomic, principal consultant at ENCO, 
Vienna, Austria 

► A.M. Versteegh, former managing director 
at Nuclear Research and consultancy Group, 
Petten, The Netherlands 

The Committee's main duties are: 

► To determine whether the KCB meets the 
above mentioned 25% criterion specified in 
the Covenant. 

► To assess safety in relation to design, 
operation, maintenance, ageing, and safety 
management. 

► To assess safety as far as possible by 
reference to quantified indicators. 

► In so far as quantitative comparison is not 
possible, to make the comparison on the 
basis of expert qualitative assessment. 

► To carry out its duties objectively, 
independently of the interests of industry, 
civil society organisations, politics, and 
current government policy. 



1 Covenant Kerncentrale Borssele -juni 2006 

2 Although Switzerland is not a member of the European Union it largely follows on a voluntary basis the European regulations on 
nuclear safety and actively participates to European initiatives on nuclear safety. Swiss power plants were therefore included in the 
benchmark. 
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To be able to carry out its duties, the Committee 
needed and obtained full cooperation of 
the KCB and access to all documents related 
to safety of the KCB. In order to do this, 
it was assured that the confïdentiality of 
such documents would be respected and 
safeguarded where needed. 

This report contains the results of the 
first assessment of the Committee and its 
unanimous opinion on the basis of these 
results. Before going into these results, it should 
be emphasized that: 

> The task of the Committee is not to give an 
absolute opinion on the safety of the KCB, 
but to compare its safety with that of the 
water-cooled and water-moderated power 
reactors in the European Union, the United 
States of America, and Canada. On the basis 
of that comparison, the Committee will state 
whether in its opinion the safety benchmark 
condition of the covenant is met. 

I Much of the information the Committee 
needed could only be obtained if strict 
confïdentiality would be ensured. For this 
reason the information in this report is 
anonymised to the level needed to ensure 
confïdentiality. 

> Considering its task, the Committee focuses 
only on safety aspects that are relevant 

for the protection of the environment 
surroundingthe plant. Safety aspects 
relevant only for the consequences inside 
the plant are not taken into account. These 
consequences are considered a (economie) 
risk for the plant owners. 



In the following chapters, the used methodo- 
logy is described (chapter 2), the steps in the 
evaluation are explained in more detail and 
the results are provided (chapter 3 and 4). 
The findings of the site visits are described in 
chapter 5 and the final chapter (chapter 6) of 
the report presents the relation between the 
findings of the recent European post-Fukushima 
stress test and the findings of the Committee. 
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Methodology 



The benchmark study covered approximately 
250 2 nuclear power plants, divided into three 
basic types: Pressurised Water Reactors (PWR), 
Pressurised Heavy Water Reactors (PHWR), and 
Boiling Water Reactors (BWR). Figure 2-1 shows 
the relative f ractions of these types in the 
total population of the plants covered by the 
benchmark study. A geographical distribution of 
the reactors is shown in Figure 2-2. 

To fully quantify a safety ranking of so many 
different nuclear power plants is an impossible 
task. The safety of a plant cannot be expressed 
in one well-defined number. Some would argue 
that the Probabilistic Safety Analysis (PSA), 
combining both the design and operations in 
one model, manages to translate all into one 
significant plant risk level. To do this, the PSA 
model combines data on reliability of plant 
components and of the operators to determine 
the probability of a core meltdown, or in case 
of a so called Level 2 PSA, the probability of 
release of radioactivity into the environment. 



While PSA is a recognised and highly useful tooi 
for assessing and improving plant safety, their 
results are not suitable for comparison. This is 
mainly due to the differences in assumptions 
used in the model, the level of details of the 
model, but also the methodology and the data 
selected. To enable the comparison of several 
plants, the PSA would need to be developed 
and quantified in a highly standardised way, 
which is not the case today. Re-doing PSA in 
a standardized way for the purpose of the 
assessment within the Borssele benchmark 
would require an enormous effort, and even 
then be hindered by the availability of plant 
specific information and data. 

Furthermore, ranking plant safety is a 
dynamic process with a time dependant 
outcome. Requirements for nuclear safety 
are basically the responsibility of national 
regulatory authorities, which implies that 
the importance attached to various safety 
aspects is not necessarily uniform. The efforts 



Figure 2-1 | Distribution of the reactor types in the benchmark 
population 




Figure 2-2 | Geographical distribution of the benchmark 
population 



O Europe 
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The exact number changes over time due to the commissioning of new plants and the shutdown of existing plants, and therefore 
cannot be given 
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of organisations, Li ke IAEA, to harmonize 
these requirements withstanding national 
differences remain. Also, opinions about 
what is important for nuclear safety evolve 
over time as a result of operating experience 
including root cause analyses of incidents. The 
speed and possibilities to adapt plants to new 
requirements differ too. 

Taking these considerations into account, the 
Committee had to develop its own methodology 
to establish an expert opinion on the safety 
of the KCB, using available information on 
the different elements of plant's safety that 
could be meaningfully compared among 
the approximate 250 plants. It should be 
emphasised however that even a simplified 
approach is challenged by the fact that 
although there is a lot of information available 
on power plants internationally, much of it is 
not comparable enough for a numerical ranking 
of the approximate 250 plants to consider. 
Nevertheless, after looking into numerous 
reports, assessments and comparisons 
undertaken, which sometimes encompassed 
hundreds of pages of documentation, the 
Committee feels confident that by smart use 
of the available data in combination with 
expert qualitative assessment it is possible to 
determine, with sufficiënt confidence, whether 
KCB is among the safest 25% of water-cooled 
and water-moderated nuclear power stations in 
Europe, the USA, and Canada. 

The committee is convinced that it developed 
a meaningful methodology on the basis of all 
available information that could be used to 
compare the safety of the KCB to that of the 
other 250 plants considered. This methodology 
contains, because of their different nature, a 



separate safety assessment of: 
> reactor design 

t reactor operations (covering operation, 
maintenance, safety management, and 
ageing) 

Schematically the Committee opted for the 
approach as shown in Figure 2-3. 

Separating the safety characteristics of 
design from the safety characteristics of plant 
operations was necessary because of their 
different nature. The assessment of the design 
was carried out for all approximate 250 nuclear 
power plants, based on specified key design 
features. For evaluating the safety of the way 
plants are operated the Committee opted for a 
two-step approach. In the first step it decided 
to select the top 25% of best performing plants 
on the basis of performance indicators. These 
indicators reflect performance in the past but 
do not assure the same performance in the 
future. To cover this, the Committee concluded 
that it is equally important to assess, in the 
second step, whether safety performance is 
the result of well-defined and well-managed 
processes directed by the plant's management. 
Considering the amount of information needed 
for a detailed process analysis it is only 
feasible for a sample of the plants concerned. 
However, to determine if KCB's performance 
in the management of operations is similar 
to that of the 25% of best performing plants 
in operations from that group, it is sufficiënt 
to compare KCB in a detailed analysis with a 
properly selected sample. 

The results of the assessments of plant design 
and operations were complemented by a 
number of site visits. 
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Figure 2-3 | Schematic approachfor the benchmark 
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Evaluation of Design Safety 



3.1 Introduction 

To enable a desk top evaluation of the safety 
level of the plant's design, the Committee 
needed to identify a set of prominent features 
and quantify their relevance to the potential 
hazard of the plant for the surrounding 
environment. This methodology resulted in a 
scoring scheme. 

Further implementation of this approach 
included: 

► A pilot study on 15 plants, upon which the 
scoring scheme for the categorisation was 
tested in practice and adjusted to assure a 
realistic representation of the design safety 
level. 

► The collection of design information on the 
operating nuclear power plants considered 
for the benchmark. 

► The evaluation and ranking of the entire 
group of nuclear power plants within the 
scope of the benchmark, according to the 
refined scoring scheme. 

The pilot study was performed on 15 plants of 
different designs and ages. These were ranked 
according to the initially proposed ranking 
scheme. This pilot study was also intended to 
verify the availability and obtainability of plant 
specifïc data needed for the assessment. 
The plants for the pilot study were chosen 
to cover the entire time span during which 
nuclear power plants operating today in Europe 
and North America started operation, which 
means between 1969 and 2004. Furthermore, 
the plants were chosen in a way to include all 
reactor types. Plants with the same reactor type 
but with different suppliers were included in 
the pilot study too. 



BBC 



Design 



Operations 



Operation 
Maintenance 
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Conclusion 



Ageing 



3.2 Definition of key 
design features and 
categories 

Ranking plant design safety requires the defini- 
tion of key design features and determination 
of their expected relevance/impact for the 
potential external radiological impact of the 
plant. 

All currently operating nuclear power plants 
belongto the so-called "second generation". 
They include three basic reactor types, which 
are the subject of this evaluation: 
► Light water-moderated reactor: 

- Pressurised Water Reactor - PWR 

- Boiling Water Reactor- BWR 

t Heavy water-moderated reactor: 

- Pressurised Heavy Water Reactor - PHWR 

Regardless of being developed by a number 
of vendor countries (USA, Germany, France, 
Canada, USSR), the initial safety concepts and 
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requirements of the three above mentioned 
reactor types were originally designed to a 
more or less similar level, though in some 
cases (i.e. German design) advanced safety 
features were introduced earlier than by some 
other vendors. With accumulated and shared 
operating experience and new safety concerns 
(e.g. lessons from the TMI accident in the USA 
in 1979) both regulators and industry increased 
their safety demands and requirements. This 
resulted in diverging solutions addressing the 
same cause and thus in different features being 
added to the designs in order to enhance the 
safety Level. 

Worldwide efforts in enhancing levels of safety 
were intensifïed in the last decade, mainly by 
harmonization of design requirements. Through 
Periodic Safety Reviews (in Europe) orthe 
Regulatory Compliance Programme (in the USA), 
plant characteristics were periodically checked 
against new safety insights and requirements. 
In many cases, adaptation of nuclear plants 
(backfitting) was required. 

To assure plant safety, three fundamental 
safety functions need to be assured under all 
circumstances: 

1) Reactivity control 

2) Heat removal 

3) Confinement of radioactivity 

These fundamental safety functions remain 
the same for all types of light or heavy water 
reactors. 

The starting point for the assessment reflects 
the most relevant design concept to assure 
nuclear safety, the "defence-in-depth" concept 
(see Table 3-1). Defence-in-depth encompasses 



all safety elements of a nuclear power plant, 
whether organisational, behavioural, or 
hardware related. It assures that there are 
overlapping or backstopping provisions, so that 
if a failure were to occur it would be detected, 
compensated for or corrected by appropriate 
measures. The application of the concept of 
defence-in-depth throughoutthe design and 
operation provides a graded protection against 
a wide variety of anticipated operational 
occurrences, design basis accidents, and severe 
accidents, including those resulting from 
equipment failure or human action within the 
plant and hazards that originate outside the 
plant. 

Levels 1 and 2 of the defence-in-depth are 
mainly addressed by prudent design and 
appropriate safe operation. Both are verifïed 
by the regulatory body; design during the 
initial licencing process and safety in operation 
through regulatory inspections (oversight) 
and periodic safety review or other mandated 
regulatory checks. Within the Committees 
evaluation, the Level 2 defence-in-depth was 
assessed as a separate element; operational 
safety. The design-related evaluation within 
the Committees framework addressed Level 
1 of the defence-in-depth by looking at the 
redundancy and diversity. Nevertheless, the 
focus of the Committees assessment was 
on safety aspects that are relevant for the 
environment surrounding the plant, as this, due 
to higher level protections, is where today's 
nuclear power plants differentiate between 
safe and very safe. To adequately capture those 
aspects, the assessment focussed on enhanced 
capabilities for accident control and accident 
mitigation and for containing radioactive 
substances within the plants' interior. These are 
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TabLe3-l | Defence in depth concept (ref. IAEA INSAG-10) 



Levels of defence 
in depth 


Objective 


Essential means 


Level 1 


Prevention of abnormal operation and 
failures 


Conservative design and high quality in 
construction and operation 


Level 2 


Control of abnormal operation and 
detection of failures 


Control, limiting and protection systems, 
and other surveillance features 


Level 3 


Control of accidents within the design 
basis 


Engineered safety features and accident 
procedures 


Level U 


Control of severe plant conditions, 
including prevention of accident 
progression, and mitigation of the 
consequences of severe accidents 


Complementary measures and accident 
management 


Level 5 


Mitigation of radiological consequences 
of significant releases of radioactive 
materials 


Off-site emergency response 



mainly the elements of the level 3 and level 4 
of the defence-in-depth. 

The key engineered design features for control 
and mitigation of accidents have the following 
objectives: 

\ Control accidents to remain below the 

severity level postulated in the design basis. 

\ Control severe plant conditions and 
mitigation of consequences, including 
confïnement protection. 

Given this background, the Committee 
identified four relevant design features, which 
determine the safety level of the plant f rom 
the perspective of potential impact on the 
environment: 

► Redundancy and diversity of safety systems 

► Containment 

► Availability of bunkered systems 
\ Severe accident management 



3.2.1 Redundancy and Diversity 

Redundancy and diversity are the major design 
features that have a dominant impact on the 
probability of events/accidents that may lead to 
overheating of the reactor core (e.g. due to lack 
of cooling) and thus so called "core damage" or 
"core melt". 

Redundancy is referring to the multiplication 
of critical components or systems with the 
intention of increasing the reliability of the 
system (e.g. two, three or even four parallel 
pumps or systems where only one or two 
would be needed to fulfïl the required safety 
function). 

Diversity is referring to having different kinds 
of equipment to do the job to improve the 
availability (partly) of a given function under 
all circumstances e.g. electric, steam, or diesel 
driven pumps. 
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Redundancy and diversity principles are 
employed in all nucLear power station designs. 
With the same goal of assuring safety, practical 
solutions employed by different designers vary 
greatly, making their comparison relevant only 
from the point of view of their contribution 
to safety. Whether providing redundancy and 
diversity at the f unction level (different systems 
employing diverse operating principles capable 
of performing the same safety function) or at 
the system level (one system only with highly 
redundant and sometimes diverse components 
performing a specific safety function), the final 
goal of ensuring safe operation is considered 
to be achievable in all cases. In particular, the 
way redundancy and diversity is realized, differs 
greatly between PWRs/PHWRs and BWRs, due 
to the principle differences between these 
reactor types. 

To achieve a high level of safety, redundancy 
and diversity have to be deployed in the 
design of the systems and components 
important for safety, as well as the associated 
support systems. New insights into the 
adequacy of redundancy and diversity need 
to be incorporated in already operating 
plants through modifications of the existing 
equipment (backfitting). 

The Committee realises that its approach results 
in a rather high-level comparison. However, a 
more detailed analysis would require a large 
amount of information (which is not available 
and would be nearly impossible to obtain for 
all reactors involved), and an extremely large 
amount of data related to detailed systems 
and components and their functional relation. 
Nevertheless, the Committee is of the opinion 
that the added value of the collation of a large 



volume of data would not be justified by a 
limited added precision of the assessment. 

The assessment by the Committee resulted in 
the following matrix (Table 3-2) for evaluating 
and ranking of redundancy and diversity. 
Although the selection and categorisation 
reflect international practices and many years 
of experience available to the Committee, there 
is a certain level of subjectivity in the selection 
of the categories above. The Committee is 
aware that the areas selected for consideration 
of redundancy and diversity could be chosen 
differently and that the degrees of redundancy 
and diversity could be defined differently. 
In order to assess what influences different 
categorisation might have on the outcome, a 
sensitivity analysis was undertaken. The final 
conclusion was that with the methodology 
chosen, this effect was limited and not relevant 
for the final categorisation. 

3.2.2 Containment 

The confinement of radioactive material in a 
nuclear power plant, including the control of 
discharges and the minimization of releases, is 
a fundamental safety function to be ensured 
during normal operational modes, anticipated 
operational occurrences, design basis accidents 
and, to the extent possible, severe accidents. 

In accordance with the concept of defence 
in depth, this fundamental safety function is 
achieved by means of multiple barriers and 
levels of defence. The containment - a strong 
structure enveloping the nuclear reactor - is 
a major factor in achieving the objectives of 
the third and fourth levels of defence. The 
containment structure also serves as protection 
of the reactor against external hazards. 
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TabLe 3-2 | Scoring criteria for redundancy and diversity 



REDUNDANCY AND DIVERSITY 




PWR / PHWR 


BWR 


1 


2 x 100% 11 or less redundancy in emergency 
core cooling system; 

No diversity in auxitiary feedwater system 


No redundancy in high pressure coolant 
injection; 

2 x 100% or 3 x 50% in low pressure coolant 
injection; 1 x 100% in core spray 


2 


More than 2 x 100% redundancy in emergency 
core cooling system; 

No diversity in auxiliary feedwater system 
OR 

2 x 100% redundancy in emergency core cooling 
system; 

Diversity in auxiliary feedwater system 


Redundancy, no diversity in high pressure 
coolant injection; 

4 x 50% or 3 >< 100% in low pressure coolant 
injection; 

1 x 100% in core spray 
OR 

No redundancy in high pressure coolant 
injection; 

4 x 50% or 3 x 100% in low pressure coolant 
injection; 

2 x 100% in core spray 


3 


More than 2 x 100% redundancy in emergency 

core cooling system; 

Diversity in auxiliary feedwater system 


Redundancy and diversity in high pressure 
coolant injection; 

4 x 50% or 3 x 100% in low pressure coolant 
injection; 

2 x 100% in core spray 



1) 2 x 100% redundancy implies that one of two system parts is sufficiënt to fulfil the required function. 

4 x 50% redundancy implies that two of the four available system parts are sufficiënt to fulfil the required function. 



Several containment designs are employed in 
the currently operating nuclear power plants: 

> Pressure suppression containments where 
pressure suppression is obtained by one of 
the following means: 

- suppression pool 

- bubbling condenser 

- ice condenser 

Pressure suppression is reached by directing 
the high-pressure steam-air mixture that is 
generated during a pipe rupture accident 
into water pools (first two types), or through 
vent doors into chambers containing ice. 



The cold water or ice condenses the steam 
leading to decrease of the containment 
pressure. 

> Full pressure dry single containment - 

steel shell or concrete building (cylindrical 
or spherical) with or without a steel liner 
designed to withstand the increase in 
pressure and temperature that occurs in 
the event of any design basis accident, 
especially a Loss of Coolant accident; the 
atmospheric pressure in the containment 
envelope is usually maintained at a negative 
gauge pressure during normal operations. 
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► Full pressure doublé wall containment - a 

steel or concrete shell, basically cylindrical 
or spherical in shape (the containment, with 
or without a liner) surrounded by a concrete 
shell (the secondary confinement); leakage 
from the containment is captured in the 
annulus between the two shells. 

AU the designs mentioned above provide a 
broadly equivalent level of protection in the 
case of design basis accidents. For severe 
accidents, it is commonly accepted that a 
full-pressure doublé wall containment would 
be more favourable and limit the releases in 
cases of accidents involving damage of the 
core. Further to this, doublé wall containments 
additionally designed to withstand major 
external impact like the crash of an aircraft 
would be able both to protect the core from 
this external impact and prevent the release 
of radioactivity. Such containments were 
considered to provide the highest safety Level 
in this evaluation. The containment function 
was finally grouped into three levels, as shown 
inTable3-3. 



3.2.3 Bunkered systems 
Hazards of internal or external origin such 
as explosions or fires, flooding, earthquakes, 
and malevolent acts have the potential to 
initiate events that would simultaneously 
affect or breach more than one safety barrier 
and adversely affect design features provided 
for mitigating the consequences. Specially 
designed bunkers that contain some of the key 
systems (like power supplies, heat removal, 
and basic controls) were not included in the 
original design of most nuclear power plants. 
Those were added later on to increase plant 
safety by assuring protection of safety systems 
from internal and external hazards. The 
bunkered systems also resulted in increase of 
redundancies and the solution of deficiencies 
(e.g. inadequate spatial separation, one of the 
most important protective features for internal 
and external hazards), if not provided for by the 
original design. 

Initially, bunkered systems were seen as an 
additional redundancy, sometimes relying on 
the same supporting function, e.g. the water 
supply. Lately, more and more sophisticated 
systems were constructed often having multiple 
trains and completely autonomous power and 
water supply. 



Table 3-3 | Scoring criteria for the containment 



CONTAINMENT 



1 Pressure suppression containment (all types) or full pressure dry single containment 

2 Full pressure doublé wall containment 

3 Full pressure doublé wall containment capable to withstand a crash of an aircraft 
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Natural hazards were, to a different extent, 
considered in the initial design of nuclear 
power pLants. Where experience or analyses 
later showed that additional hazards needed 
to be considered, safety improvements were 
made. Manmade hazards were also considered 
in some designs, like external explosions 
caused by nearby industrial facilities or impact 
of aircrafts. 

In the last decade, more severe external hazards 
of human origin, e.g. big commercial aircraft 
crashes, have called for attention. Although 
no bunkered systems were recently added 
specifically for the purpose of improved safety 
in such cases, some plants benefit from robust 
design improvements implemented in the past. 

Some of the older operating plants that were 
backfitted with bunkered systems attain 
a safety level equivalent to newer plants. 
The safety analyses performed in the last 
decade show that, even though not designed 
specifically for this purpose, some bunkered 
systems offer comparable protection against 
modern threats such as the deliberate impact 
of a modern Long-range commercial airplane. 
In such conditions, the existence of properly 
designed safety systems capable of preventing 



a core melt can be equally important than the 
containment function. 

The level to which bunkered systems can 
withstand conventional and modern threats is 
in the Committee's opinion the most important 
factor in defining their value to plant safety. On 
this basis, three safety levels were identified 
to be used in ranking the safety of design, as 
shown in Table 3-4. 

3.2.4 Severe accident management 

Severe accidents are generally considered 
to be events beyond the design basis for the 
generation of nuclear power plants that is in 
operation now. In those beyond design basis 
events, it is assumed that multiple failures 
of safety-related systems would occur, thus 
compromising the capability to maintain 
adequate cooling of the f uel and resulting in 
significant damage to the fuel (core melt), and 
possibly compromising the containment. Under 
certain circumstances, the containment may 
also be postulated to fail or to be bypassed, 
potentially resulting in a major radioactive 
release to the environment. 

To enhance the protection against those beyond 
design basis events, nuclear power plants are 



Table 3-4 | Scoring criteria for the bunkered systems 



BUNKERED SYSTEMS 



1 Bunkered systems withstanding conventional hazards of natural and human origin 
2 

3 Bunkered systems withstanding both conventional and modern threats 



Bunkered systems withstanding conventional hazards and with limited resistance against modern 
threats. 
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developing and adopting an approach caLled 
Severe Accident Management (5AM), usually 
represented in a form of guidelines (SAMG) to 
be used by operators. SAM encompasses both 
the equipment and the actions taken during 
the course of a severe accident by the plant 
operating staff to: 
I Prevent core damage 

> Restore failed equipment, or use any other 
available equipment to prevent or minimise 
the consequences of the accident 

> Maintain containment integrity for as Long 
as possible 

> Minimize offsite releases 

Main concerns related to severe accidents 
include: 

> Reactor vessel integrity 

Severe accidents may involve core damage 
that progresses to the stage at which core 
geometry is compromised, and molten core 
material may relocate into the bottom of the 
reactor pressure vessel. The molten mass 
may then cause degradation of the vessel. 
Strategies may be employed to depressurize 
the reactor pressure vessel and to provide 
adequate cooling of the debris, f rom either 
inside or outside the reactor pressure vessel, 
so as to maintain vessel integrity. 

> Hydrogen control 

Generation of hydrogen during an accident 
involving significant core damage is a 
concern for water-cooled and water- 
moderated reactors. Release of hydrogen 
into the containment can pose a threat of 
hydrogen deflagration or detonation. Such 
events could cause increase in containment 
pressure that could affect the containment 
integrity for certain containment designs. 



► Containment integrity 

The containment building is the last 
barrier against the release of radioactive 
material to the environment in the event 
of a severe accident. Consequently, it is 
essential that the containment remains 
intact for a substantial period during severe 
accidents. Radioactive material can also 
be released by bypassingthe containment 
even if the building itself remains intact. 
Strategies may therefore be employed to 
make the containment more robust against 
failure modes and to limit potential bypass 
pathways to the environment. 

The severe accident management approach 
systematically identifies non-safety-related 
systems that could be employed in a severe 
accident, and any actions necessary to realign or 
reconfigure those systems in such an event, and 
determines the best ways in which to employ 
the systems' capabilities. The initial element 
of severe accident management is enhanced 
instrumentation allowing the monitoring of 
plant parameters and accident evolution. 
Existing instrumentation can be used provided 
it is qualified for operation under the harsh 
conditions of a severe accident. 

Dedicated hardware and modifïcation of 
existing equipment for severe accident 
mitigation include means like: 

► Connection of the station grid to adjacent 
stations to provide for additional 
functionality of safety systems when the 
power is lost. 

► "Feed and bleed" capability to provide for 
depressurisation and injection of coolant, 
thus compensating for loss of designated 
cooling systems. 
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> Cavity flooding to provide for cooling the 
reactor vessel from outside, thus preventing 
the failure of the vessel. 

> Passive autocatalytic recombiners to 
provide for removal of hydrogen from 
the containment, thus preventing the 
deflagration that could compromise 
containment's integrity. 

> Filtered venting of the containment to 
prevent the failure of the containment with 
minimal impact on the environment. 

Some or all of these features were considered 
and prepared for functioning in nuclear power 
plants as part of the implementation of severe 
accident management concepts. 

The level to which plants have equipped 
themselves for severe accident management, 
modified existing hardware or installed 
dedicated hardware for this purpose was 
the basis for defining scores for this aspect 
of design. The safety levels the Committee 
considered relevant are indicated in Table 3-5. 



3.2.5 Final scoring table 

The final evaluation of the safety of design, 
taking into account the considerations for each 
key feature as presented in the subsections 
above, was based on the Table 3-6. The scoring 
system using this table resulted in scores that 
could range between a maximum of 12 and a 
minimum of 4, a higher score corresponding to 
a higher safety level of the design. 



Table 3-5 | Scoring criteria for Severe Accident Management 



SEVERE ACCIDENT MANAGEMENT 



1 Monitoring, use of existing means, no plant specific SAMGs. 

2 Monitoring, use of existing means following plant specific SAMGs. 

3 SAMGs and dedicated hardware or modified existing hardware. 
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TabLe 3-6 | Finalscoring criteria for the of the safety of design 



REDUNDANCY AND DIVERSITY 




PWR/PHWR 


BWR 


1 


2 x 100% or less redundancy in emergency 
core cooling system; 

No diversity in auxiliary feedwater system 


No redundancy in high pressure coolant injection; 
2 x 100% or 3 x 50% in low pressure coolant 
injection; 1 x 100% in core spray 


2 


More than 2 >< 100% redundancy in 

emergency core cooling system; 

No diversity in auxiliary feedwater system 

OR 

2x100% redundancy in emergency core 
cooling system; 

Diversity in auxiliary feedwater system 


Redundancy, no diversity in high pressure coolant 
injection; 

4 x 50% or 3 x 100% in low pressure coolant 
injection; 

1 x 100% in core spray 
OR 

No redundancy in high pressure coolant injection; 
4 x 50% or 3 x 100% in low pressure coolant 
injection; 

2 x 100% in core spray 


3 


More than 2 >< 100% redundancy in 
emergency core cooling system; 
Diversity in auxiliary feedwater system 


Redundancy and diversity in high pressure coolant 
injection; 

4 x 50% or 3 x 100% in low pressure coolant 
injection; 

2 x 100% in core spray 


CONTAINMENT 


1 


Pressure suppression containment (all types) or full pressure dry single containment 


2 


Full pressure doublé wall containment 


3 


Full pressure doublé wall containment capable to withstand a crash of an aircraft 


BUNKERED SYSTEMS 


1 


Bunkered systems withstanding conventional hazards of natural and human origin 


2 


Bunkered systems withstanding conventional hazards and a certain limited resistance against 
modern threats 


3 


Bunkered systems withstanding both conventional and modern threats 




1 


Monitoring, use of existing means, no plant specific SAMGs 


2 


Monitoring, use of existing means following plant specific SAMGs 


3 


SAMGs and dedicated hardware or modified existing hardware 
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3.3 Pilot study results 

A pilot study was used to test and adjust 
the scoring scheme for the categorisation 
in practice in order to assure a realistic 
representation of the design safety level. The 
pilot study led to some improvements in the 
ranking method, and in the end it gave the 
Committee comfort that the methodology it 
developed was appropriate for the evaluation 
of the safety of design. From the pilot study the 
Committee concluded that: 

► The plants selected have scores in the entire 
range possible, with a denser population in 
the middle of the scale and scarcer towards 
both ends. 

► The scoring system is not sensitive to the 
reactor type; both Pressuruized Water 



Reactors and Boiling Water Reactors rank in 
the top 25% and below. 

> The scoring system is not sensitive to plant 
age; both older and newer plants have high 
scores as well as low ones. 

> The results do not depend exclusively on 
one of the design features, nor are they 
insensitive to any of them. 

These conclusions were reconfirmed in the final 
design benchmark. 

3.4 Final results 

A graphical representation of the distribution 
of plants among the score categories is given in 
Figure 3-1. This figure also shows the relative 
f ractions of the major plant types. 



Figure 3-1 | Distribution of plants of different types within the score categories 
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Scores assigned to the plants cover the range 
of 4-12, with a denser population in the low- 
middle part of the scale range (score categories 
5-7) and scarcer towards both ends (fractions 
of plants with the score of 4 and 12 are -3.2% 
and ~3.6%, respectively). The majority of 
plants have the score in the range of 5-6 
(total fraction with his score range is 73%). 
The categorization chosen by the Committee 
enhances the differentiation between safe and 
very safe, resulting in a non-linear distribution 
of the results: most plant score in the range 4-6 
("safe") while the score of the top 25% ("very 
safe plants") spreads over the range 6-12. 
The scoring system is insensitive to the reactor 
type. Pressurised Water Reactors as well as 
Boiling Water Reactors are distributed equally 



amongthe broad range of the score categories. 
Pressurised Heavy Water Reactors are in the 
"safe" range. 

The top 25% fraction of the plant population 
(-60 plants) basically included the plants with a 
score from 12 to 7, as shown in Figure 3-2. KCB 
scores 9 points, ensuring a place well within the 
top 25%. 

The scoring scheme utilised in the benchmark 
places all the four features of design safety at 
the same level of importance. To analyse the 
sensitivity of the results for this assumption 
the Committee performed a sensitivity analysis 
changing the relative importance of the four 
features. In this analysis the importance of each 
of the design features was, in turn, reduced to 



Figure 3-2 | Distribution of plant scores and top 25% group for design safety 
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half or doubled, while maintaining the same 
score for the other three. 



This sensitivity analysis showed that: 

> The top 25% does not change in any of the 
studied cases. 

> A few plants change their position within 
the top 25% but none are leaving the top. 

> KCB rises one position in one case and 
descends one or two positions in the other 
seven cases but keeps its score of 9 points 
thus remains well within the top 25%. 

The results of the sensitivity study show, thus, 
that the benchmark results for design safety are 
not driven by any single design feature of the 
four considered, but by their combination. 
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Conclusion 



For evaluating the safety of the way the plants 
are operated the Committee has opted for a 
two-step approach. In the first step it decided 
to select the top 25% of best performing plants 
on the basis of performance indicators. These 
indicators reflect performance in the past but 
do not assure the same performance in the 
future. To cover this, the Committee concluded 
that it is equally important to assess, in the 
second step, whether safety performance is 
the result of well-defined and well-managed 
processes directed by the plant's management. 



4.1 First step evaluation of operational safety 



4.1.1 Introduction 

The first step of the Operational Safety 
Benchmark focuses on the selection of the top 
25% of best performing plants against which 
KCB is to be compared. For this selection a 
set of internationally accepted performance 
indicators is applied. 

To improve the quality of performance, the 
nuclear industry has instituted an internal 
reporting system to monitor operations 
on the basis of a number of performance 
indicators. The reliability of the reporting is 
regularly checked in peer reviews. Most of 
these performance indicators are relevant for 
evaluating the safety performance in plant 
operations. It includes the following indicators: 



practices in maximising the electrical power 
generation. It provides an overall indication 
of how well plants are operated and 
maintained. 

Forced Loss Rate 

The outage time and power reductions that 
result from unplanned equipment failures, 
human errors, or other conditions during 
the operating period (excluding planned 
outages and their possible unplanned 
extensions) are a good indicator for the 
effectiveness of plant programs and 
practices in maintaining systems available 
for safe electrical generation when the plant 
is expected to be at the grid dispatcher's 
disposal. 



k Unit Capability Factor 

This performance indicator is generally 
accepted in the utility industry to indicate 
the effectiveness of plant programs and 



k Unplanned Automatic Plant shutdowns 
(scrams) 

The number of unplanned automatic 
scrams is a generally accepted indicator to 
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monitor plant safety. It includes the number 
of undesirable and unplanned thermal- 
hydraulic and reactivity transients that 
result in reactor scrams, and thus gives an 
indication of how welL a plant is operated 
and maintained. Manual scrams and, in 
certain cases, automatic scrams as a result of 
manual turbine trips to protect equipment 
or mitigate consequences of a transient 
are not counted because operator initiated 
scrams and actions to protect equipment 
should not be discouraged. 

► Safety System Performance 

Monitoring the readiness of important 
safety systems to perform their functions in 
response to off-normal events or accidents, 
gives insight in the effectiveness of 
operation and maintenance practices. 

> Fuel Reliability Indicator 

Failed fuel represents a breach in the initial 
barrier preventing off-site release of fission 
products. Failed fuel also increases the 
radiological hazard to plant workers. 

► Chemistry Performance Indicator 

This indicator monitors the concentrations 
of important impurities and corrosion 
products in selected plant systems to give 
an overview of the relative effectiveness of 
plant operational chemistry control. 

> Collective Radiation Exposure 

Collective radiation exposure to plant 
workers is an important indicator for the 
radiation exposure within the plant and 
the effectiveness of radiological protection 
programs. 



I Industrial Safety Accident Rate 

Industrial safety accident rate was chosen 
as the personnel safety indicator over other 
indicators, such as injury rate or severity 
rate, because the criteria are clearly defined 
and most Utilities currently collect this data. 

4.1.2 Selection of the top 25% of best 
performing plants 

On a confidential basis the Committee had 
access to the performance indicators indicated 
above and used them to define the top 25% 
of plants with the best safety performance in 
plant operation of the approximate 250 nuclear 
power plants the Committee had to consider. 
To do so the performance indicators had to 
be combined into a composite number using 
weighting factors expressing their relevance for 
plant safety. 

The first time the Committee did an evaluation 
of the safety performance of plant management 
was in 2008. Updates were provided up to 
2012. Considering the fact that scores in such 
type of monitoring systems can be substantially 
affected by one-off items, the Committee 
decided to use multi-year averages. 

In all evaluation updates KCB was in the top 
part of the 25% plants that had the best scores 
on the basis of these indicators. The results for 
the latest evaluation are given in Figure 4-1, 
which gives the number of plants in a certain 
scoring range. A higher score (horizontal axis) is 
related to a better result in the evaluation. 

With a score just above 70, KCB is well within 
the top 25% plants with the best performance 
in the safety of plant operation on the basis of 
performance indicators, as shown in Figure 4-1. 
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Figure 4-1 | Distribution of plant scores and top 25% reference group for operational safety 
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The Committee was aware that although these 
indicators cover a broad range of aspects 
that are of importance for the safety of plant 
management, such an evaluation could only 
be considered as a first level indication of 
the performance of the KCB compared within 
this group. A more in-depth evaluation was 
needed to obtain insight into whether KCB's 
performance is the result of a well-controlled 
process. To do so the Committee performed an 
in-depth process analysis of the performance 
of the nuclear power plants. In this study it 
looked separately to the elements of relevance 
including Operation, Maintenance, and Safety 
Management on the one hand and Ageing 
Management, on the other hand. Considering 
the nature of this process evaluation (see 
section 4.2 and 4.3) it was deemed sufficiënt 



to compare KCB in a detailed analysis with a 
properly selected sample of the group of best 
performing plants. 
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4.2 Operation, Maintenance and Safety Management 



4.2.1 Introduction 

The process analysis in the second step of the 
Operational Safety Benchmark focuses on the 
extent to which the safety performance of a 
plant is the result of a welL-controlled process 
directed by the plant's management. Such an 
analysis requires good understanding about 
the way the plants are operated and managed. 
The Committee concluded that for a process 
analysis of operation, maintenance, and safety 
management the only appropriate derestricted 
information are the available reports from 
the Operational Safety Review Team (OSART) 
programme of IAEA. 



Design 



BBC 
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► Operation 
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Conclusion 




Under the OSART programme, a team of experts 
conducts an in-depth review of operational 
safety performance, addressing the issues that 
are affecting the management of safety and 
the performance of personnel. It is important 
to stress that the OSART's, while being peer 
reviews (team members are typically senior 
management of nuclear power plants or 
regulatory bodies) are conducted to the same 
set of guidelines and to the unique criteria, 
those being the standards and guides of the 
IAEA. By identifying problems and areas of 
concern, the OSART programme provides 
advice and assistance to the nuclear power 
station management on enhancement of the 
operational safety. 

In addition, the OSART programme provides 
an opportunity to disseminate information on 
"good practices" which are recognised during 
OSART missions. 



The OSART missions review performance in the 
following areas: 

► Operations 

► Maintenance 

» Technical support 

► Radiation protection 

► Chemistry 

► Operating experience 

► Emergency planning and preparedness 

► Management, organisation, and 
administration 

► Training and qualification 

► Commissioning 

The result of an OSART mission is a report 
presenting the team's observations and 
conclusions. It includes the discussion and 
references to all recommendations, suggestions, 
and good practices identified by the team. The 
OSART report is (automatically) derestricted 
ninety days after its issuance, except if the host 
country requests otherwise. 
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Due to the level of details and its coverage, its 
high professional assessment as well as using a 
unified set of criteria, the OSART reports consti- 
tute an adequate basis for benchmarking the 
safety performance in operations, maintenance, 
and safety management of KCB against its peers. 

Ageing management is not addressed in the 
OSART reviews and an equivalent source of 
information is lacking. Considering also the fact 
that for a meaningful evaluation of KCB's perfor- 
mance in this area a different peer group would 
be needed, the Committee decided to do process 
evaluation of ageing management separately. 

4.2.2 In-depth review of operation, 
maintenance, and safety management 
While the comparison based on (numerical) 
performance indicators is rather straightforward, 
a process evaluation implies understanding of 
the philosophy of operation of a nuclear power 
plant and the organisational, management, and 
operational practices that may vary significantly 
across the countries and operating organisations. 

The Committee decided that such an evaluation 
would require: 

a) Consideration and evaluation of all findings 
of the OSART: strengths (good practices) and 
weaknesses (areas for improvement). 

b) An assessment byjudgingthe 'importance 
to safety' of each OSART finding. 

c) A ranking of KCB against the other plants in 
the peer group. The results of the ranking 
were expressed in relative terms, equally, 
better or worse than each peer. 

The nuclear plants that were included in this 
detailed evaluation were selected using a 
number of criteria: 



► Good geographical spread over the bench- 
mark area: European Union, USA, and Canada. 

t High score on operational performance, 
preferably ranking in the top 25% on the 
basis of performance indicators. 

> OSART mission in the recent years for which 
the report is publicly available. 

The final selection of 10 peers was based on the 
expert opinion of the Committee and, in view of 
the desired geographical spread, included three 
plants outside the top 25% group. 

Out of the peer group of ten nuclear power 
plants, the Committee selected three plants for 
a pilot study, in order to verify the applicability 
of the benchmarking method developed by the 
Committee. The plants selected for the pilot 
study have different reactor designs, and also 
different ranking based on the performance 
indicators. After the methodology was defined 
and tested in the pilot study, the remaining 
seven nuclear power plants and KCB were also 
evaluated. 

Categorization and classification of OSART 
findings 

The methodology chosen for the benchmark 
involved the operational safety of a nuclear 
power station as seen by the expert judgment 
of the OSART team and the Committees' 
judgment on the 'importance for safety' of the 
OSART findings. The latter involved identifying 
suitable parameters to categorize the plant's 
strengths (e.g. good practices) and weaknesses 
(e.g. areas for improvement) as indicated by 
the OSART. First of all we decided not to use 
the "good practices" in our ranking scheme. 
Subsequently, all other OSART findings for each 
of the 11 plants (peer group and KCB) needed to 
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be classifïed by their importance for safety. 
A relative large number of approaches to 
evaluate the importance of findings for nuclear 
safety, considering the safety management, 
defence in depth, and safety culture was 
studied. On the basis of this study, a structure 
to objectively categorize the safety significance 
of each OSART finding (recommendation, 
suggestion or note) was proposed. The 
categorization consists of fïve groups with a 
decreasing safety importance: 

Group I 

► Overall safety management 

Findings categorized in this group would 
be those related to the managerial aspects 
of safety. This includes findings related 
to the management of plant programs 
and activities that are impacting safety, 
including plant organisation, safety 
assessments and reviews, risk evaluations, 
procedures and training for the management 
and supervisory personnel, reporting 
and corrective actions, including use of 
operational experience feedback, etc. 
Because of its cross-cutting potential to 
weaken the overall operational safety 
performance (i.e. multiple safety barriers 
could be affected) this group was given 
the highest weighting factor. Findings in 
this group could be an indication of a weak 
overall operational safety performance. 

Group II 

> Plant operation during normal and 
abnormal situations 

Findings categorized in this group would 
be those where plant safety has been 
challenged, including plant's compliance 
with its operational limits and conditions 



and/or its ability to withstand deviations 
from normal operation. These findings 
cover issues such as the competence and 
skills of operators, operating practices, the 
status of systems and components, the 
quality of procedures, and adequacy of 
their usage. The findings in this group may 
be an indication of deficiencies affecting 
equipment and personnel, undermining 
prevention capabilities and/or plant safety. 
This is the reason that findings in this group 
have the second highest weighting factor. 

> Human performance 

Operational experience from the nuclear 
industry demonstrates that 70 % of events 
in nuclear power stations are caused by 
inadequate human performance. Findings 
related to human factors or performance 
may be an indication of weakened safety, 
and are thus very important for the overall 
safety of the plant. Therefore the findings 
in this group were also given the second 
highest weighting factor. The issues in this 
group include a range of issues from training 
and qualifications to performance and 
rectification of identified deficiencies. AU 
findings regarding human performance are 
included in this group. 

Group III 

► Functioning of plant systems and 
equipment, plant integrity 

The findings in this group are related to 
the functioning of plant's systems and 
equipment and/or integrity of plant's 
structures. As such, those are providing 
the support for safe operation of the 
plant. Findings in this group are related 
to equipment maintenance programme. 



35 



The Safety of Borssele, Nuclear Power Station | First report of the Borssele Benchmark Committee 



engineering support activities, and other 
specialized programmes, including e.g. 
equipment qualifkation, fire protection, 
chemistry control, etc. Being a support 
rather than a front line function, the findings 
of this group receive Lower rating than the 
previous group. 

> Management of deviations and failures 

OSART missions typically look into the 
conduct of preventive activities at a plant, 
thus identifying deficiencies related to 
control of deviations and/or failures of plant 
systems and equipment before those would 
lead to more serious situations. Examples of 
findings include operational issues, ability 
to timely identify the faults and deficiencies 
related to surveillance procedures. Being of 
a preventive nature, findings in this group 
receive lower rating than the previous one. 

Group IV 

I Personnel safety 

One element of the OSART is devoted to 
the assessment of the radiation protection 
and industrial safety programmes. Despite 
the fact that these aspects are important 
safety elements, their impact is primarily 
affecting plant personnel. As the focus 
of the assessment, within the Borssele 
Benchmark, is on the impact on the public 
and environment, the findings within this 
group could be assessed as being less 
significant than those belonging to groups 
l-lll. 

> Emergency preparedness 

The basic principle of nuclear safety is 
to operate the plant in such a manner to 
exclude the potential impact on the public 



and environment. In the unlikely case of a 
radioactive release to the environment, the 
direct threat to population and environment 
is minimized through adequate emergency 
planning and preparedness, which generally 
is the responsibility of off-site authorities. 
OSART looks into the on-site emergency 
preparedness. Any findings in this area 
are not directly related nor an indication 
for the overall safety status of the plant. 
Therefore, similarly to those related to 
personnel safety, findings in this area could 
be considered less significant than those 
belonging to groups l-lll. 

Group V 

> Insignifkant issues 

There are comments in the OSART reports 
related to different aspects of plant 
operations that do not relate to or have 
significant impact on the plant safety Level. 
Such type of findings is primarily meant to 
be opportunities for enhancement, rather 
than an indication of safety challenges. 
Therefore, the findings of group V do not 
warrant consideration in the ranking scheme 
(i.e. the impact is considered null). 

Further to the weighting factors for each of 
these five groups, a second categorization of 
significance for plant safety was added, based 
on the OSART categorization of the issues in: 

> Recommendations; R - being a very 
significant finding, deserving prompt 
rectification 

> Suggestions; S - being a finding where 
management might consider making a 
change 

» Notes; N - being a remark not obliging plant 
management to act 
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The Committee also considered that from the 
point of view of their potential impact, the 
issues for which recommendations, suggestions 
or notes are made can vary in significance. 
A third layer of classification was therefore 
introduced to account for the contribution 
of each issue to a safety performance. This 
classification was made based on expert 
judgment and includes three levels: high (H), 
medium (M) and Low (L) safety significance. 



This threefold categorization and classification 
is represented in the resulting ranking matrix 
(Table 4-1), which combines all the three above 
discussed levels, of which the most important is 
the one reflected by the 5 groups of evaluation 
criteria, the second is the OSART categorization 
reflected within each of the groups, and the 
third is the consideration of the impact on the 
safe plant operation of each individual issue. 



Table 4-1 | Final Ranking Matrix 



Criterion 


Value 


Issue Type 


Significance 


High 


Medium 


Low 


Group 1 

1. Overall safety management 


4 


R 

Score 


100% 

4 


80% 

3,2 


60% 

2,4 






S 

Score 


50% 
2 


35% 
1,4 


20% 
0,8 






N 

Score 


15% 
0,6 


10% 
0,4 


5% 
0,2 


Group II 

2. Plant operation during normal and 


3 


R 

Score 


100% 

3 


80% 

2,4 


60% 

1,8 


abnormal situations 
3. Human performance 




S 

Score 


50% 
1,5 


35% 
1,05 


20% 
0,6 






N 

Score 


15% 
0,45 


10% 
0,3 


5% 
0,15 


Group III 

4. Functioning of plant systems and 


2 


R 

Score 


100% 

2 


80% 

1,6 


60% 

1,2 


equipment, plant integrity 
5. Management of deviations and 
failures 




S 

Score 


50% 
1 


35% 
0,7 


20% 
0,4 






N 

Score 


15% 
0,3 


10% 
0,2 


5% 
0,1 


Group IV 

6. Personnel safety 


1 


R 

Score 


100% 

1 


80% 

0,8 


60% 

0,6 


7. Public and environment 




S 

Score 


50% 
0,5 


35% 
0,35 


20% 
0,2 






N 

Score 


15% 
0,15 


10% 
0,1 


5% 
0,05 


Group V 

Insignificant/out of scope issues 
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4.2.3 Results 

The above evaluation matrix was tested in 
the pilot study. lts aim was to assess the 
robustness of the methodology as a whole and 
of the system for classification in particular. 
Upon completing the assessment on each of 
the three plants in the pilot study, the results 
were reviewed by an independent expert who 
was familiar with the status (and operational 
safety) of each plant. The expert concluded 
that the results obtained are in line with the 
general perception of the OSART teams when 
visiting the plants. This assessment gave 
confïdence that the proposed approach and 
the methodology would be appropriate for 
the utilization for the Borssele benchmark. 
Following the pilot study the remaining seven 



peers and KCB were then evaluated using the 
same methodology. 

The results of the evaluation are presented in 
the graph in Figure 4-2. 

4.2.4 Sensitivity analysis 

To confirm the adequacy of the benchmark 
methodology, the variation of the results with 
changes in the parameters that have potential 
for significant impact on the results, was 
studied. The sensitivity analysis was performed 
twice, first for the pilot study plants, and 
secondly, reconfirmed for all plants. In 
particular it was studied whether taking the 
OSART Notes into account would have a large 
influence on the ranking. In Figure 4-3 the 



Figure 4-2 | Results of the evaluation 
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FigureA-3 | Results of the evaiuation without Notes 
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results are given if Notes are not taken into 
account. 

It was concluded that this does not have a Large 
influence. Although some plants change place 
in the ranking, the net effect is not significant. 

The second parameter that was thought poten- 
tially to have significant impact on the results 
was the importance of Suggestions relative to 
the Recommendations, which were considered 
to be the most important conclusions of the 
OSART missions. For this sensitivity analysis the 
significance of the Suggestions was increased in 
the evaiuation scheme (see Figure U-U). 

This resulted of course in higher scores for all 
plants, but their ranking remains basically the 



same. This outcome shows that the ratio between 
the significance of the Recommendations and 
that of the Suggestions is not a dominating 
parameter of the evaiuation scheme. 

The purpose of detailed analysis of KCB's 
performance in control, maintenance and 
safety management was to obtain a credible 
insight into whether KCB's safety performance 
is the result of a well-managed process, 
when compared to its peers. The approach 
combines all the aspects of operational safety 
into a composite judgement. Regardless of 
specific management or technical approaches 
that a plant might follow, it focuses on the 
results/outcomes, thus avoiding impact of 
the technology or plant's organisation or 
management structure. 
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Figure U-U | Results of the evaiuation with increased significaree of Suggestions 
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The results show that the score of KCB is in 
the middle of the range (fïfth position) of the 
scores obtained by the 11 peer nuclear power 
plants. The sensitivity analyses indicate that 
this outcome was not affected by the choice 
of the evaiuation methodology, nor by specific 
"weighting" elements. Even though the input 
data contain a number of uncertainties related 
to the moment in time when the OSART 
mission was conducted, as well as to the 
uniformity and subjectivism of the evaiuation, 
the approach taken assures that the results 
are robust. The middle score obtained by 
KCB supports the conclusion that also from a 
process management point of view, the safety 
performance in plant operations, maintenance 
and safety management of KCB is comparable to 
that of the selected peer group. 
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4.3 Ageing 



4-3.1 Introduction 

Ageing refers to the general process in which 
characteristics of a system, structure, or 
component gradually change with time or use. 
Examples of ageing mechanisms include curing, 
wear, fatigue, creep, erosion, microbiological 
fouling, corrosion, embrittlement, chemical or 
bioLogical reactions, and combinations of these 
processes e.g. erosion-corrosion, creep-fatigue. 
Since ageing can have impact on both nuclear 
power plant safety and performance, effective 
management of ageing is a key element in safe 
and reliable operation of nuclear power plants. 



Design 
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► Operation 

► Maintenance 
» Safety Mgt. 
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Conclusion 




To maintain plant safety and preserve the 
option of plant life extension, plant personnel 
must be able to effectively manage the 
physical ageing of plant components important 
to safety by controlling significant ageing 
mechanisms and detecting and mitigating 
their effects before failures occur. Ageing 
management means engineering, operations, 
and maintenance actions to control, within 
acceptable limits, the ageing degradation 
and wear out of systems, structures, and 
components. 

The effect of ageing on the actual physical/ 
material conditions of the systems, 
structures and components influences the 
plants performance, which will show in the 
performance indicators to evaluate these 
conditions. Similarly to the approach taken in 
the detailed review of operation, maintenance, 
and safety management (see section 4.2), 
the ageing review focuses on the question 
to what extent ageing management is a well- 
managed process. To determine this, the 



Committee opted for a process evaluation of 
the management of physical/material ageing 
of systems, structures, and components. The 
review consisted of an evaluation of ageing 
management governance and of ageing 
management implementation at KCB versus 
a properly selected sample of nuclear power 
plants (the peer group) from the top 25% of 
plants with the best performance in operations. 

The first step in developing the method for 
the evaluation of ageing consisted of the 
selection of practical Ageing Management 
Criteria (AMC) based on IAEA guidelines on 
ageing management. These guidelines provide 
recommendations for managing ageing of 
systems, structures and components important 
to safety, including recommendations on key 
elements of effective ageing management and 
an outline of a review of ageing management 
for long term operation. The guidelines contain 
generic attributes, which should be part of 
every component-specific Ageing Management 
Programme (AMP) (see Table 4-2). 
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TabLe 4-2 | Generic attributes ofan effective Ageing Management Programme (AMP) (Ref:IAEA Safety Guide NS-G-2.12) 



Attribute/ Review topic 


Description/ Assessment basis/criteria 


1. Scope of the ageing 
management programme 

ha*;prl nn unripr^tanrlinp 

UQJCU w 1 1 UMUUlJLullUMItl 

ageing 


> System, structure (including structural elements) or component 
(SSC) subject to ageing management. 

ft 1 JnHpr^tanHino 1 nf scrpincr nhpnnmpna (QÏcrni'fifsnl' acrpincr 

F UMUCI J La 1 IU 1 1 lp. UI OgC 1 1 1 £: UI ICI IUI 1 ICI lü l^lgMMI^OML.utiCMIli; 

mechanisms, susceptible sites): 

- SSC materials, service conditions, stressors, degradation 
sites, ageing mechanisms and effects 

- SSC condition indicators and acceptance criteria 

- Ouantitative or qualitative predictive models of relevant 
ageing phenomena 


2. Preventive actions to 

minimize and control ageing 
degradation 


1 Identification of preventive actions. 

1 Identification of parameters to be monitored or inspected. 

► Service conditions (i.e. environmental conditions and operating 
conditions) to be maintained and operating practices aimed at 
slowing down potential degradation of the SSC. 


3. LJC ItLUUl 1 u 1 dgtr 1 1 Ig tr 1 l CLlb 


W C 1 1 trLLI vtr LcLl IMULUgy \ lllbptrLLIUII, LtrbLI [ Ig dllU 1 1 IUI 1 1 LU I II tg 

methods) for detecting ageing effects before failure of the SSC. 


4. Monitoring and trendingof 
ageing effects 


► Condition indicators and parameters to be monitored 

1 Data to be collected to facilitate assessment of SSC ageing 

t Assessment methods (including data analysis and trending). 


5. Mitigating ageing effects 


1 Operations, maintenance, repair and replacement actions to 
mitigate detected ageing effects / degradation of the SSC. 


6. Acceptance criteria 


1 Acceptance criteria against which the need for corrective action is 
evaluated. 


7. Corrective actions 


► Corrective actions if the SSC fails to meet the acceptance criteria. 


8. Operating experience 
feedback and feedback of 
R&D results 


> Mechanism that ensures timely feedback of operating experience 
and R&D results (if applicable), and provides objective evidence 
that they are taken into account in the ageing management 
programme. 


9. Quality management 


t Administrative controls that document the implementation of the 
ageing management programme and actions taken. 

1 Indicators to facilitate evaluation and improvement of the ageing 
management programme. 

► Confirmation (verification) process for ensuring that preventive 
actions are adequate and appropriate and all corrective actions 
have been completed and are effective. 

► Record keeping practices to be followed. 



The criteria developed by the Committee were 
on the one hand aimed at evaluating the ageing 
management governance (i.e. documentation of 
a plants policy, organisation, and methodology 



for ageing management) and on the other hand, 
at evaluating the way ageing management 
was implemented in practice. To do so the 
Committee evaluated the actual ageing 
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management for a selected number of relevant 
systems, structures and components. 

The second step in developing the method for 
the evaluation of Ageing involved the develop- 
ment of a methodology for the comparison of 
the ageing management programs at KCB with 
those of the selected group of plants in Canada, 
USA, and Europe. To check and refine this 
methodology a pilot study was performed on 
one EU, one US and one Canadian plant. 

4.3.2 Selection of a peer group for 
ageing management review 
Following the pilot study, a peer group of 
nuclear power plants was selected for the 
evaluation of ageing management using the 
following selection criteria: 

► Belonging to the top 25% of plants with the 
best performance in operations (see section 
4.1). 

k Having an age relevant for this benchmark. 

> Availability of recent information on ageing 
management programmes relating to ageing 
management criteria, such as reports on: 

- US License Renewal 

- Periodic Safety Review including a 
review of ageing management consistent 
with the IAEA Safety Guide on periodic 
safety reviews 

- IAEA SALTO review for which the report is 
publicly available 

- Other information on ageing manage- 
ment programmes for the evaluation 
using ageing management criteria 
available directly from the nuclear power 
plant 

On the basis of these selection criteria, a peer 
group of five plants was selected. 



4.3.3 Ageing management review 
methodology 

To perform the ageing benchmark evaluations 
for KCB and the selected peer group, the 
following aspects of ageing management were 
reviewed: 

a) Overall Ageing Management Programme 

- The plants' policy, organisation, and 
methodology for ageing management 

b) Specific ageing management programmes 
for: 

- FLow accelerated corrosion of high energy 
carbon steel piping and valve bodies 

- Insulation materials of electrical cables 

- Buried piping and tanks 

c) Ageing management scope for long term 
operation 

- Systems, structures, and components 
important to safety included in an ageing 
management programme for long term 
operation of a nuclear power plants 

d) Specific time limited ageing analyses for: 

- Reactor vessel neutron embrittlement 

- Metal fatigue of class 1 piping 

- Environmental qualification of electrical 
equipment. 

The specific ageing management programmes 
and time limited ageing analyses were chosen 
to make the evaluation result-oriented. The 
specific items were selected by the Committee 
because of their importance for effectiveness of 
ageing management for older plants. 

The first step in the evaluation was a desk top 
review. The next step was the clarification 
and verification of review topics of which 
information was not clear or incomplete, 
executed by using e-mail, telephone, and in 
some cases a site visit. 
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The evaluation of each of the selected plants 
was reported in a narrative form and by a 
matrix. This matrix shows for each of the 
selected items the extent (fu LI, partial or not) to 
which the plant meets the ageing management 
criteria defined by the Committee on the basis 
of international standards. 

Following this analysis, the performance 
of KCB regarding ageing management was 
compared with the performance of each of 
the other plants in the peer group. Results 
of the comparison were expressed for each 
item in relative terms indicating whether the 



performance of the KCB ageing management 
was better, equal or worse than that of the 
plants in the peer group. 

4.3.4 Results 

Ageing management assessment for KCB 

The evaluation of the ageing management 
programme (AMP) of KCB and its compliance 
with the ageing management criteria (AMC) is 
summarised in Table 4-3. 

Summarising, the KCB ageing management 
activities are currently largely consistent with 
the ageing management criteria (based on the 



Table 4-3 | Ageing management matrix for KCB 



AMP aspect 


AMC 
fully 
met 


AMC 
partly 
met 


AMC 
not 
met 


Remarks 


Overall plant AMP 




V 




Ageing Management Programme (AMP) governance does 
not meet criteria; development in progress. 


Specifïc AMPs for: 
» FAC 

1 Buried piping 
» Insulation of el. 
cables 


V 
V 
V 






The ageing management criteria for the following specific 
systems, structures, and components that are important to 
safety are met: 

► Flow accelerated corrosion (FAC) of high energy 
carbon steel piping 

► Buried piping and tanks 

► Insulation materials of electrical cables 


AMP scope for long 
term operation 


V 






Adequately identified in accordance with IAEA guidelines 
and ageing management criteria. 


Time limited ageing 
analyses revalidation: 
► Embrittlement 
1 Metalfatigue 
1 Environmental 

qualification 

of electrical 

equipment 


V 
V 


V 




Revalidation of the following time limited ageing analyses 
has been performed and accepted by the regulator: 

► Reactor vessel neutron embrittlement 

> Metal fatigue of class 1 piping 
Environmental qualification (EO) of electrical 
equipment 

Some recommendations on the last one are still to be 
implemented but they are included as a condition in the 
new license and thus secured. 
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IAEA guidelines). However, there is a need for 
improvement of coordination and traceability of 
ageing management by properly implementing 
and documenting a formal ageing management 
governance. Since this is still underway, the 
overall plant ageing management programme 
only partly meets the relevant ageing 
management criteria. The three reviewed 
system, structure, and component-specific 
ageing management programmes, as well as the 
programme scope for long term operation meet 
the relevant ageing management criteria. Two 
of the three time limited ageing analyses fully 
meet the relevant ageing management criteria; 



the 3rd one meets partly the criteria as some 
items are still to be implemented by the end of 
2013. 

Comparison of KCB with the ageing 
management peer group 

To compare KCB with the peer group for ageing 
management review, all five nuclear power 
plants in the peer group were analysed in a 
similar manner as KCB. The results of these 
analyses were then compared with that of KCB. 
The outcome of this comparison is summarised 
in Table A-A. 



Table 4-4 | Ageing management comparison 



AMP aspect 


KCB 
better 
than peers 


KCB and 
Peers 
equal 


Peers 
better 
than KCB 


Remarks 


Overall plant AMP 






5 


KCB governance does not 
meet criteria; implementation 
and documentation of ageing 
management system for 
overall plant AMP in progress; 
completion planned by the end 
of 2013 


Specifk AMPs for: 
» FAC 

1 Buried piping 

► Insulation of el. cables 


3 


5 
5 
2 




Some ageing management 
programme attributes not yet 
implemented at 3 plants 


AMP scope for long term 
operation 




4 




Not relevant for 1 plant 


Time limited ageing analysis 
(TLAA) revalidation: 
1 Embrittlement 
► Metal fatigue 
1 Environmental 

qualification of electrical 

equipment 




3 
3 
1 


2 


Not relevant for 2 plants 

Some items of TLAA revalidation 
for EO of el. equipment are 
still to be implemented by KCB 
before the end of 2013 
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The following comments should be added: 

► Overall plant ageing management 
programme deals with the ageing 
management governance, i.e. the plant's 
policy, organisation, and methodology for 
effective ageing management. At present 
implementation and documentation of an 
ageing management governance that meets 
the criteria (based on IAEA guidelines) 

is for KCB less complete than for each of 
the five peer nuclear power plants. This 
is due to the fact that until recently, KCB 
ageing management was implemented 
using existing operation and maintenance 
programmes and activities subject to 
on-going optimization based on relevant 
operating experience under the guidance of 
an Ageing Management Team. KCB explained 
to the Committee its plans to implement an 
ageing management system, consistent with 
the Dutch regulations and IAEA guidelines 
on ageing management (and thus with 
the ageing management criteria) which 
includes organisational arrangements for 
appropriate assignment of responsibilities 
for implementation of ageing management 
programmes of specific systems, structures, 
and components. This should be completed 
by the end of 2013. Once this is completed 
and meets the ageing management criteria, 
the overall plant ageing management 
programme could be rated as "equalto 
peers". 

> Specific ageing management programmes 

deal with the extent to which the ageing 
management programmes for three specific 
systems, structures, and components have 
the generic attributes of an effective ageing 
management programme given in the IAEA 



Safety Cuide on ageing management. KCB's 
ageing management programmes for flow 
accelerated corrosion (FAC) of carbon steel 
piping and valve bodies containing high- 
energy fluids and for buried piping and 
tanks are equal to its peers. KCB is equal 
to two and slightly better than three peer 
plants in the quality of ageing management 
procedures and their implementation for 
insulation materials of electrical cables. 

t Ageing management programme scope 
for long-term operation involves a check 
if a representative sample of systems, 
structures and components (consisting of 19 
passive and long-lived systems, structures 
and components that are not subject to 
replacement based on a qualified life or 
specified time period) is included in a plant 
ageing management programme. In this 
aspect, KCB is equal to four peer nuclear 
power plants; the fifth one does not plan 
long term operation, at present. 

► Time limited ageing analyses revalidation 

deals with the extent to which there is, 
for the three selected time limited ageing 
analyses, an adequate demonstration that 
one of the following criteria is met: 

- The analysis remains valid for the period 
of long-term operation. 

- The analysis has been projected to the 
end of the period of long-term operation; 
or 

- The effects of ageing on the intended 
function(s) will be adequately managed 
for the period of long-term operation. 

In the ageing management aspect of 
environmental qualification (EO) of 



electrical equipment, KBC is equal to 
one peer plant and two peer plants are 
slightly better because some items of the 
revalidation of time limited ageing analysis 
for environmental qualifïcation of electrical 
equipment are still to be implemented by 
KCB before the end of 2013. Time limited 
ageing analysis revalidation is not relevant 
for the two other peer plants. 

Overall, the evaluation leads to the conclusion 
that the ageing management of KCB and its 
peers are in general comparable, which could 
be expected because they all generally follow 
the IAEA guidelines. Outstanding ageing 
management work at KCB that is being currently 
addressed includes; issuing formal KCB 
documentation articulating ageing management 
strategy, organisational arrangements, and 
methodology, completion of a few items from 
the revalidation of time limited ageing analysis 
for environmental qualifïcation of electrical 
equipment, and documentation of procedures 
for more systems, structures and components- 
specific ageing management programmes. 

It is envisaged that the performance of the 
ageing management of KCB and its five peer 
plants will be equal at the end of 2013 (i.e. 
before the start of KCB's long term operation as 
required by the operating licence) when KCB's 
formal ageing management implementation 
and documentation and all time limited ageing 
analysis should be completed. 
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Site visits 
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5.1 Site visit objectives 



The objective of the site visits was to check 
whether the conclusions that were obtained 
through the desk top analysis are supported by 
the impression on-site on the way the plants are 
managed. In particular whether the strengths 
and weaknesses, as compared with KCB, that 
were identified in the peer review process are 
in line with the impressions obtained during the 
plant visits. 

The aim was further to understand how specific 
operational safety aspects are managed at each 
of the visited plants and to compare these with 
operational safety aspects at KCB. 



geographical distribution. This led to a selected 
list of 5 plants in: 

> France 

I Cermany 

> Belgium 
I Slovenia 

> Canada 

The site visits were carried out after finalization 
of the desk top analyses and were conducted 
by three Committee members in Europe and by 
two in Canada. 



The plants for the site visits were with one 
exception selected from the peer group 
used for the process analysis of operation, 
maintenance, and safety management. In the 
selection attention was given to a proper 
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5.2 Site visit organisation 

The visit consisted of two parts, one being the 
presentation by the host plant management 
foLlowed by discussion or clarifïcation on a 
number of topics, and the other being a plant 
tour. 

The committee asked the plant management 
to cover in their presentation in particular the 
following items: 

Operational Safety Management 

k Control of plant status and configuration 

► Monitoring and measuring of safety 
performance 

► The corrective measures process 

► Operator knowledge and skiLLs 

► Operational Experience Feedback 

Maintenance 

I Condition based maintenance 

► Risk informed approaches in maintenance 

► Monitoring of maintenance performance 

► Outage management 

► Management of contractors 

Ageing Management 

► Overall plant ageing management 
programme (AMP) 

t Systems, structures and components - 
specific ageing management programs 

► Ageing management programme scope for 
long term operation (ITO) 

► Validity of time limited ageing analyses 
(TLAA) for the planned period of long term 
operation 



Operation Safety Culture 

► Implementation of safety policy 

I Management commitment and leadership 

► Attitudes of individuals 

► The learning organisation 

► Reporting culture 

During the plant tour the Committee Experts 
aimed at obtaining an impression regarding 
issues such as: 

► Main control room operations and the status 
of the reserve/emergency control room 

► Material conditions and housekeeping 

► Maintenance working places (maintenance 
shops as alternative) 

► Specific areas to observe the equipment 
dedicated to accident management 

► Conditions of safety related systems, 
in particular those to be utilised in the 
emergency situations (emergency power/ 
ultimate heat sink/accident management 
equipment/bunkered systems) 

An additional aspect of the plant tour was to 
observe, as far as possible, the behaviour of the 
plant managers and personnel in the execution 
of their functional responsibilities. 
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5.3 Site visit results 

As overall result of the site visits the Committee 
concluded that the impressions were in line 
with the results from the desk top reviews. 

In all plants visited it was illustrated that 
business processes in the nuclear industry 
are specified in great detail and controlled 
accordingly. Although there are differences in 
the way plants are managed the operational 
performance of these plants is definitely the 
result of strictly specified and controlled 
processes and procedures. 

Using operational experience to further 
improve very detailed and controlled business 
processes can easily lead to ever expanding 
manuals. This can impede their effectiveness 
also regarding safety. The nuclear industry 
recognised this danger and concluded that 
improving the quality of business processes 
required not more command and control, but 
better command and control. This applies in 
particular to improving plant safety. Promoting 
a safety-oriented attitude at all hierarchy levels 
could lead to better specifications of processes 
and more effective control. The committee was 
particularly interested to obtain insight during 
the plant visits what progress had been made in 
this area. 

Below the observations of the Committee 
on this item are given together with other 
observations that were the result of these visits: 

> Improving safety awareness and safety 
culture gets a lot of management attention 
in the plants visited. It was evident that 
translating this concept into effective 



measures is not an easy task. It takes time to 
convince the organisation of the importance 
of the concept and cultural differences 
play a role in translating it into effective 
measures. As a result, the approaches 
chosen differ, as well as the progress plants 
have made in this area. 

> An important tooi for mobilizing the 
organisation for improvements is to lower 
the threshold for reporting events/incidents 
and suggestions for improving performance. 
Improving feedback to the organisation on 
actions taken as a result of event reports 
and suggestions for improvement is equally 
important. The committee noted that the 
amount of reports/suggestions per plant 
vary considerable between plants (from 
1000 to 5000/year) as well as the level of 
feedback. Nevertheless this tooi is used in 
all plants visited. 

> Another tooi to improve safety is to 
incorporate the insights of probabilistic 
safety analyses (PSA) in the decision- 
making. Not only in the large decisions 
related to improvements of design 

by backfitting but also in day-to-day 
decisions, for instance for the planning of 
maintenance. The plants most advanced in 
this area introduced the concept of a "living 
PSA"; this implies the use of PSA to monitor 
the safety level at any time, by quantifying 
the effect on safety of every realised or 
intended change in the plants. The use of a 
"living PSA" is specifically useful in planning 
maintenance. 
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► Safety is not a static, but a dynamic item. Not activities within the nuclear industry by 
only will requirements become stricter over WANO. 

time as a result of operating experience and 
the root cause analyses of nuclear incidents, 
but plants will also improve the safety of 
their design and operations continuously. 
AU plants visited were working on 
improvements in response to the Fukushima 
incident. Continuous improvement through 
a learning organisation is very much a 
characteristic of the nuclear industry. 

► In operations the increased use of 
simulators to train operators is noticeable. 
They are not only used for initial training but 
also for regular refreshment courses and dry 
runs for complicated operations. Simulators 
are a 1 to 1 copy of the actual control room 
and to facilitate a more integrated use in 
daily operations some plants install them 
nowadays on site. 

► The committee was interested to see 
if there was a difference in managing 
safety between plants that operate stand- 
alone and plants that are part of a larger 
organisation with more nuclear plants. 
The Committee noted that there are larger 
organisations with more nuclear plants 
that opt for a centralised structure with a 
large supporting staff, but others that opt 
for decentralised operations with fairly 
autonomous plants. The smaller stand-alone 
plants like KCB are noticeably more active 

in international exchange of information 
and experience, for instance through 
participation in IAEA reviews of operations 
and ageing management and similar 
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The stress tests on EU Nuclear 
Power plants by the European 

Council 



In the aftermath of the Fukushima accident, in 
March 2011 the European Council concluded, 
"the safety of all EU nuclear plants should be 
reviewed, on the basis of a comprehensive 
and transparent risk and safety assessment" 
("stress test"). The European Nuclear Safety 
Regulatory Group (ENSREC) endorsed the 
approach proposed by the Western European 
Nuclear Regulators Association (WENRA) where 
all plants were to be evaluated in a coordinated 
manner, with peer review being undertaken 
at EU level. Switzerland and Ukraine also 
participated in the stress test. The assessments 
were conducted by operators of all EU nuclear 
power plants, reviewed by national authorities 
who developed national stress test reports and 
submitted to ENSREC at the end of 2011. 

The national reports were subject to an 
extensive EU wide peer review process, 
managed by the ENSREG Peer Review Board, 
and carried out from January to May 2012. The 
peer review included topical reviews of national 
reports and the on-site review of one nuclear 
power plant in every participating country. 
The review results were summarised in the 
stress test peer review report that reported on 
the safety level of the nuclear power plants 
in the whole of Europe. Seventeen individual 
national reports were also prepared with 
detailed recommendations relevant for each 
country. As a follow up, the National action 
plans in response to both national and Europe- 
wide recommendations were developed and 
submitted to the ENSREG for a peer review, 
which took place in April 2013. 

The Europe-wide fïndings of the stress tests 
were that there are no technical reasons 
requiring immediate shutdown of any nuclear 



power plant in Europe. A series of good 
practices and recommendations were also 
identified. It was also concluded that for all 
plants there is room for safety improvements. 
Those were, on plant specific basis, taken on 
board and further developed in the National 
action plans. 

When consideringthe approach of the 
ENSREG's stress test and the methodology used 
by the Borssele Benchmark Committee (BBC) it 
is important to note the differences between 
the two: 

> The subject was different: within the stress 
test 143 nuclear power plants in the EU, 
Switzerland, and Ukraine were evaluated. 
The Committee compared the safety of KCB, 
against that of the approximate 250 water- 
cooled and water-moderated nuclear power 
plants in the EU, US, and Canada. 

> The objective was different: the stress test 
was aimed at assessing the robustness of 
each nuclear power plant in the group in 
terms of their resilience against extreme 
external events. The stress test determined 
the safety margins that each nuclear power 
plant has against a set of (external) events 
that could be postulated to occur at the site. 
The Committee's objective was to determine 
whether the KCB is among the 25% safest 
of its kind in the EU, the US, and Canada. 
The Committee did so by comparing safety 
features of KCB against those of the other 
plants considered. 

> The scope was different: the stress test 
assessments were very comprehensive 
and focussed on a number of safety issues 
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that were the initiators of the Fukushima 
accident and issues that influenced the 
propagation and hampered the mitigation of 
the consequences: 

- External events (earthquakes, flooding, 
extreme weather conditions) 

- Loss of eLectrical power and loss of 
ultimate heat sink 

- Severe accident management 

For its assessment the Committee did not 
consider the extreme challenges of Fukushima 
type. However it assessed all relevant safety 
aspect but assuming that the plants operated 
within their design base as defined within their 
licensing regimes, while taking into account 
design and operational upgrades (e.g. safety 
systems located in protected bunkers and 
introduction of severe accident managements 
guidelines, SAMGs). 

The conclusion is that while both the stress test 
and the Committee assessed safety of power 
plants, their findings are not comparable. The 
results of the stress test cannot be used for 
any meaningful ranking of safety and, thus 
cannot be used to support the evaluation by the 
Committee. 

Despite of all these differences, and in order 
to assure that no important elements were 
missed in the evaluation, the Committee 
looked at the stress test peer review report and 
the 17 country reports prepared by the peer 
review board. On the basis of these reports the 
Committee concluded that the KCB compares 
rather well with the other nuclear power plants 
evaluated in the stress test. This can be seen as 
an indication that the stress test results are in 
line with the results of the assessment by the 



Committee. An important finding is that the 
plants that scored high in the Committee design 
evaluation were found by the stress test to be 
robust and to possess large(r) safety margins. 
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